deps: pin past the yanked chacha20 0.10.1

CHANGELOG.md

@@ -14,6 +14,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   release does — is a v2 change, and upstream's own `sources/spec.md` still describes the field the
   old way. PROTOCOL.md records the same note beside the deprecation.
 
+### Security
+- **`cargo deny check advisories` failed on `main`: the dependency tree carried a yanked
+  `chacha20 0.10.1`.** It arrives through `tokio-tungstenite 0.30 -> tungstenite -> rand 0.10.2`,
+  which depends on it directly, so nothing in this crate chose the version and no `Cargo.toml`
+  change can avoid it — the lockfile is pinned forward to the republished `0.10.2` instead
+  (`cargo update -p chacha20`, lockfile only; the same update drops the `digest`/`generic-array`
+  chain `0.10.1` pulled in). A yanked crate is not itself a disclosed vulnerability, but the audit
+  denies it because a version its own author withdrew has no upgrade path and no advisory coverage,
+  and this one sits under the WebSocket stack's RNG. The check is a required status, so it also
+  blocked every unrelated pull request until now.
+
+  ⚠️ **The same regeneration repairs a `Cargo.lock` that Cargo had been refusing outright, which is
+  why the image publishes had stopped.** Six Dependabot PRs merged within about thirty seconds on
+  2026-09-07 without being rebased onto one another: the ed25519-dalek 3 upgrade resolved a lock
+  with a single `rand_core` and dropped the old `digest 0.10` chain, while the rust-minor-patch
+  group was resolved against the tree that still had both. Each lock was correct against its own
+  base and git merged them line by line with no conflict, leaving `rand 0.9.4` and
+  `rand_chacha 0.9.0` naming a bare `rand_core` while two versions of it were locked — a name Cargo
+  cannot resolve — plus six entries reachable from nothing. `cargo build --workspace` passes on that
+  lock because CI does not use `--locked`; the Dockerfile's `cargo build --release --locked` does,
+  so the only thing that noticed was the image build. Every GHCR publish failed from 2026-09-08
+  onward, and `doublezero-edge-connect:mainnet-beta` sat on the 0.38.0 client base across the
+  doublezero v0.39.0 release and the `mainnet-beta-0.39.0-1` base image published after it. No
+  reachable package changes version here beyond `chacha20`; the rest of the diff is those six
+  orphans and the names they had made ambiguous.
+
 ### Fixed
 - **A mirror publisher's `publisher_offset` was applied only by the market-by-price processor**, so
   top-of-book, midpoint and market-by-order stamped the raw wire `channel_id` into consumer-facing